Qname Minimization

This blog post aims to cover inconsistencies in the subdomain delegation process which can get exposed by a specific setting found on modern Resolvers: Qname Minimization

In this subdomain delegation setup the answer for www.staging.sydney.unw.com will depend on whether Qname Minimization is enabled or disabled on your Recursive Resolver.

With Qname Minimization Enabled: The answer will be:  10.6.6.6

When this feature is enabled the resolver sends only the next part of the label of the FQDN at every stage of iteration:

CloudFare's 1.1.1.1 has this feature enabled as of this writing and hence the our DNS name will resolve to 10.6.6.6:  

With Qname Minimization Disabled: The answer will be:  10.7.7.7

When this setting is disabled the resolver sends the full FQDN at every stage of the iteration: 

Google's 8.8.8.8 has this feature disabled as of this writing and hence it will resolve this DNS name to 10.7.7.7:

The fix:

Once a subdomain has been delegated, ensure not to create any records at the same level or below that level of hierarchy in the parent zone. All those records should go in the zone for the subdomain. 

Here is the simple and correct way of performing subdomain delegation: